NBA Public Bug Bounty · in scope
Web applications
458 assets in scope
Every dot is an asset the program lists in scope. The first 38 are named here; the program's own page has the full scope.
Open NBA Public Bug Bounty on HackerOneEvery one of the 458 is a mark on the map. Named now: 1 to 26, as listed first.
- aces-dev.wnba.com
- aces-qa.wnba.com
- aces-qa2.wnba.com
- aces.wnba.com
- adb.nba.com
- aguacaliente-dev.gleague.nba.com
- aguacaliente-qa.gleague.nba.com
- aguacaliente.gleague.nba.com
- ak-static-dev.nba.com
- allstar-dev.nba.com
- amp-nba-dev.nba.com
- amp-nba-stage.nba.com
- amp-nba.nba.com
- api.nba.com
- austin-dev.gleague.nba.com
- austin-qa.gleague.nba.com
- austin.gleague.nba.com
- auth-identity-dev-ping.nba.com
- auth-identity-dev.nba.com
- auth-identity-ping.nba.com
- auth-identity-qa-ping.nba.com
- auth-identity-qa.nba.com
- auth-identity-uat-ping.nba.com
- auth-identity-uat.nba.com
- auth-identity.nba.com
- bakersfield-qa.gleague.nba.com
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.